WIDZIALNICMS · CVE-2026-112204 · Other
NO FIX YET · SEE WHAT TO DO
WidzialniCMS has a reflected cross-site scripting flaw in its /index.php endpoint. A victim who opens a crafted link runs attacker-chosen JavaScript in their browser, which can steal session cookies.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running WidzialniCMS versions before 2.5 are exposed through the /index.php endpoint. The sources do not say which configurations or pages are needed to reach the flaw, so the exposure of any given install is unknown.
Not affected if version-2.5-or-later
Who cares cms, php, widzialnicms
2.52.5WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.
This issue has been fixed in version 2.5.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.